I understand what you're saying, but most companies (not all) don't have dedicated staff to this sort of thing. They usually take other precautions like VPNs,

I understand what you're saying, but most companies (not all) don't have dedicated staff to this sort of thing. They usually take other precautions like VPNs, etc. I'm not saying it's perfect, but for MOST people, this is a better alternative. Does that make sense? If companies made a concerted effort to hire for this and take it seriously, it makes sense. But large enterprise customers with the resources to do this aren't the majority of saleforce users.